CVE-2022-27536 Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Cause Panic in Go's Certificate Validation Two vulnerabilities have been identified in Go's crypto/x509 package affecting TLS clients. CVE-2022-27536, published on April 20, 2022, allows a remote TLS server to cause a panic on macOS with malformed certificates. CVE-2025-58188, published on October 29, 2025, results in a panic when validating certificates with DSA public keys. 3 sources 46

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

Platforms (1)